Anti-Tamper Radio meets Reconfigurable Intelligent Surface for System-Level Tamper Detection

TL;DR

This work addresses the vulnerability of system-level tamper detection to signal manipulation and environmental noise by integrating a Reconfigurable Intelligent Surface (RIS) with Anti-Tamper Radio (ATR). The authors show that RIS-enabled environment reconfiguration can unpredictably shape interior radio channels, thereby hardening tamper detection against spoofing while enabling bandwidth reduction to as low as $20$ MHz and improving resilience to disturbances like fan movements. They formalize a system model, propose attacker scenarios, and validate the approach experimentally using a RIS inside a computer enclosure, a probing-needle tampering testbed, and channel measurements, demonstrating both security hardening and robustness benefits. Overall, the RIS-ATR framework offers a promising path to secure, spectrum-efficient, and robust system-level tamper detection with practical implications for retrofitting and future 6G-like smart radio environments.

Abstract

Many computing systems need to be protected against physical attacks using active tamper detection based on sensors. One technical solution is to employ an ATR (Anti-Tamper Radio) approach, analyzing the radio wave propagation effects within a protected device to detect unauthorized physical alterations. However, ATR systems face key challenges in terms of susceptibility to signal manipulation attacks, limited reliability due to environmental noise, and regulatory constraints from wide bandwidth usage. In this work, we propose and experimentally evaluate an ATR system complemented by an RIS to dynamically reconfigure the wireless propagation environment. We show that this approach can enhance resistance against signal manipulation attacks, reduce bandwidth requirements from several~GHz down to as low as 20 MHz, and improve robustness to environmental disturbances such as internal fan movements. Our work demonstrates that RIS integration can strengthen the ATR performance to enhance security, sensitivity, and robustness, recognizing the potential of smart radio environments for ATR-based tamper detection

Figures (15)

• Figure 1: Illustration of an RIS-assisted ATR system, including an attacker attempting a physical perturbation and being capable of signal injection.
• Figure 2: Inside of the computer enclosure with two ATR antennas and the RIS. The inset shows the top lid with pre-made holes for needle insertion and and a close-view of the 0.3mm diameter probing needle.
• Figure 3: Effect of a 20mm needle insertion over frequency for four different needle insertion positions, each being unique to to the position.
• Figure 4: (a) FNR across various bandwidths. The shaded area represents the variation in FNR for different center frequencies. (b) FNR across various center frequencies.
• Figure 5: The impact of bandwidth reduction on detection: (a) With a 7 GHz bandwidth, the FNR is zero. (b) With a 20 MHz bandwidth, the FNR is $77.2\%$.